UK cyber security law forcing energy companies to report hacks has led to no reports, despite numerous hacks
A cyber security law introduced three years ago was meant to boost the resilience of the UK’s energy sector by obliging gas and electricity firms to report when they were hacked.
But since then not a single report has been made, Sky News can reveal, despite numerous successful hacks of British energy firms attributed to hostile states as well as criminal groups.
Ofgem, the authority that is meant to receive these reports, told Sky News that only one company has ever tried to file a report informing the regulator that it had been hacked, but they were dismissed as the incident did not meet the threshold for being reported.
But the high thresholds for companies working across the gas and electricity sectors to report cyber security incidents to Ofgem risks leaving the regulator blind to how the sector is actually coping in the face of these threats.
These thresholds are based on the impact of hacks to the continuity of the companies’ services, a metric that does not record the sector’s security capabilities, just the intentions of the attackers.
Dr Jamie Collier, a threat intelligence consultant at FireEye, told Sky News that the thresholds could be useful considering the varying levels of sophistication across attacks on critical infrastructure organisations, allowing defenders to “focus on what really matters”.
But the cyber security expert added: “Despite this, essential service providers and regulators should be careful not to neglect the threat posed from less sophisticated attacks.”
Source: Sky News